VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations.
CVSS 3.1CRITICAL 9.0·Network·No auth·No interaction·EPSS 0.00503·Published 2025-03-31·Fixed in 1.4.2, 1.5-stream-2025-Q2CWE-321